Freely subscribe to our NEWSLETTER

While DrDoS attack tactics have been used successfully for more than a decade, their popularity and effectiveness has increased during the past year. Specific DrDoS attacks target IP-based devices – printers, cameras, routers, hubs, sensors and other network devices – to take advantage of inherent vulnerabilities in standard network protocols, coopt the devices, and transform them into malicious bots.

“Protocol reflection attacks are a serious problem, but system administrators can help protect their organization and the Internet community by taking steps to avoid participating in these types of DrDoS attacks,” said Stuart Scholly, Prolexic President. “Unfortunately, the protocols were written with functionality, not security, in mind. The Internet used to be a safer place than it is now.”

DrDoS attacks using these protocols can be difficult to trace back to the malicious actor because they often involve spoofing, or faking, the origin of the attack.

In the new DrDoS white paper, the Prolexic Security Engineering & Response Team (PLXsert) explains how malicious actors leverage three common network protocols inherent in network servers and devices:

Simple Network Management Protocol (SNMP), used to communicate with IP-based devices, such as routers

Network Time Protocol (NTP), used to synchronize time and date information across the network

Character Generation Protocol (CHARGEN), used to test and debug network connections

The white paper, second in the DrDoS series, explains the protocol vulnerabilities and how they are used in DDoS attacks. It also identifies actions system administrators can take to reduce, or mitigate, the vulnerability of their network devices and servers.